Webhooks

Receive data from external services via incoming webhooks, and send data out via outgoing webhook calls. Both are signed and verified.

Incoming webhooks

Each incoming webhook has a unique URL: https://yoursite.com/wp-json/pfw-workflow/v1/webhooks/incoming/{key}

Setting up

Add an "Incoming webhook" trigger to a workflow
The node generates a unique key and displays the full URL
Copy the URL into your external service's webhook configuration
Activate the workflow

Security

Each webhook URL contains a random key (entropy: 128 bits)
Optional HMAC signature verification: configure a shared secret and enable "Verify signature" on the trigger
The plugin validates Content-Type and attempts to parse JSON, form data, or raw text

Payload

The trigger payload includes:

body — parsed request body
headers — all HTTP headers
method — HTTP method used
query — URL query parameters
source_ip — the sender's IP address

Capturing samples

To help map webhook fields to node inputs:

Arm sample capture: POST /pfw/v1/workflows/{id}/triggers/{nodeId}/capture-sample
Send a test webhook from your external service
Retrieve the captured sample: GET /pfw/v1/workflows/{id}/triggers/{nodeId}/sample
Use the sample to configure downstream nodes

Outgoing webhooks

Two nodes for making HTTP requests:

Node	Auth	Description
Call webhook	None or HMAC	Send a signed HTTP request. URL is branded — only validated URL references flow in.
Connected HTTP request	Connection	Send an authenticated request using a saved connection.

Outbound retry

Outbound webhook requests that fail (5xx, timeout, DNS error) are automatically retried up to 5 times with exponential backoff. After exhausting retries, they move to the Dead Letter Queue (DLQ). The hourly pfw_outbound_retry_sweep cron retries DLQ entries.

Verifying responses

Use the webhooks.validate_response condition node to branch based on HTTP status codes. Default accepted codes: 200, 201, 202, 204.